Privacy Policy

1. Who We Are

Bexora is operated by the Hawkish Group, a company registered in England and Wales. Bexora is the data controller in respect of the personal data collected through the Platform.

2. Data We Collect

3. How We Use Your Data

Bexora uses your personal data for the following purposes:

• To provide the Platform: Creating and managing your account, delivering workspace features, processing service orders and facilitating marketplace bookings.
• To process payments: Charging subscription fees and service package payments and managing billing.
• To communicate with you: Sending service updates, platform notifications, invoices, support responses and important account information.
• To improve the Platform: Analysing usage patterns, diagnosing technical issues, testing new features and improving the user experience.
• To personalise your experience: Tailoring platform features and recommendations based on your usage and preferences.
• To send marketing communications: Where you have opted in, sending newsletters, product updates and promotional offers. You can opt out at any time.
• To comply with legal obligations: Fulfilling our obligations under applicable law, including tax, accounting and regulatory requirements.
• To protect the Platform: Detecting, preventing and responding to fraud, security incidents and misuse of the Platform.

4. Legal Basis for Processing

Under UK GDPR, Bexora processes your personal data on the following legal bases:

• Contract: Processing necessary to perform our contract with you, including providing the Platform, delivering service packages and processing payments.
• Legitimate interests: Processing for purposes such as improving the Platform, preventing fraud, ensuring platform security and communicating service updates, where our interests do not override your rights.
• Legal obligation: Processing required to comply with applicable laws, such as tax and financial reporting obligations.
• Consent: Processing for marketing communications and non-essential cookies, where you have given your explicit consent. You may withdraw consent at any time.

5. Data Sharing

Bexora does not sell your personal data. We may share your data with the following categories of third parties:

• Service providers: Third-party technology and service providers who help us operate the Platform, including hosting providers, payment processors, email platforms and analytics tools. These providers act as data processors and are bound by data processing agreements.
• Marketplace providers: Where you book a service through the Bexora Marketplace, your name, contact details and service brief will be shared with the relevant provider to enable service delivery.
• Professional advisors: Legal, accounting and compliance advisors where necessary.
• Law enforcement and regulators: Where required by law, court order or regulatory obligation.
• Business transfers: In the event of a merger, acquisition or sale of all or part of our business, your data may be transferred to the relevant third party as part of that transaction.

6. International Data Transfers

Bexora primarily stores and processes data within the United Kingdom and the European Economic Area (EEA). Where data is transferred outside the UK or EEA, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the UK Information Commissioner's Office (ICO) or an adequacy decision.

7. Data Retention

Bexora retains your personal data for as long as necessary to provide the Platform and fulfil the purposes outlined in this Privacy Policy. Specifically:

• Account data: Retained for the duration of your account and for 7 years after account closure to comply with legal and accounting obligations.
• Workspace content: Retained while your account is active. Upon account closure, you may request an export of your data within 30 days, after which it will be deleted.
• Payment records: Retained for 7 years to comply with financial and tax obligations.
• Marketing data: Retained until you withdraw consent or opt out.
• Log and usage data: Retained for up to 24 months for security and platform improvement purposes.

8. Your Rights Under UK GDPR

As a data subject under UK GDPR, you have the following rights:

• Right of access: You may request a copy of the personal data we hold about you.
• Right to rectification: You may request correction of inaccurate or incomplete personal data.
• Right to erasure: You may request deletion of your personal data where there is no compelling reason for continued processing.
• Right to restriction: You may request that we restrict the processing of your personal data in certain circumstances.
• Right to data portability: You may request a copy of your personal data in a structured, machine-readable format.
• Right to object: You may object to processing based on legitimate interests or for direct marketing purposes.
• Rights related to automated decision-making: You have the right not to be subject to solely automated decisions that produce significant legal effects.

To exercise any of these rights, please contact us at info@hawkishgroup.com. We will respond to all requests within 30 days. There is no charge for exercising your rights in most circumstances.

If you are not satisfied with our response, you have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at www.ico.org.uk.

9. Cookies

Bexora uses cookies and similar tracking technologies to operate and improve the Platform. Please see our dedicated Cookies Policy for full details on category types, consent details, and management options.

10. Data Security

Bexora takes the security of your personal data seriously. We implement appropriate technical and organisational measures to protect your data against unauthorised access, disclosure, alteration or destruction, including:

• AES-256 encryption for data at rest.
• TLS 1.3 encryption for data in transit.
• Role-based access controls limiting internal access to personal data.
• Regular security assessments and penetration testing.
• SOC 2 Type II certification (in progress, targeted within 12 months of launch).

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify you and the ICO in accordance with our obligations under UK GDPR.

11. Children's Data

The Platform is not intended for use by individuals under the age of 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us immediately at info@hawkishgroup.com and we will take steps to delete that data.

12. Third-Party Links and Integrations

The Platform may contain links to third-party websites or integrate with third-party tools and services. Bexora is not responsible for the privacy practices of third parties. We encourage you to review the privacy policies of any third-party services you use in connection with Bexora.

13. AI Copilot and Data Processing

Bexora's AI Copilot processes text and data you input to generate content, summaries and automation outputs. We use third-party AI model providers to power these features. We do not use your content to train AI models without your explicit consent. Data submitted to the AI Copilot is processed in accordance with our data processing agreements with AI sub-processors.

14. Changes to This Privacy Policy

Bexora may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements or other factors. Where changes are material, we will notify you by email or by a prominent notice within the Platform. The updated Privacy Policy will be effective from the date stated at the top of this document.